snmp ifindex clear

To clear any previously configured snmp ifindex commands that were entered for a specific interface, use the snmp ifindex clear command.

snmp ifindex clear

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switches.

Usage Guidelines

Interface index persistence occurs when ifIndex values in the interface MIB (IF-MIB) persist across reboots and allow for consistent identification of specific interfaces using SNMP.

Use the snmp ifindex clear command on a specific interface when you want that interface to use the global configuration setting for ifIndex persistence. This command clears any ifIndex configuration commands previously entered for that specific interface.

Examples

This example shows how to enable ifIndex persistence for all interfaces:

Router(config)# snmp-server ifindex persist

This example shows how to disable IfIndex persistence for FastEthernet 1/1 only:

Related Commands

Enables ifIndex values that will remain constant across reboots for use by SNMP.

snmp ifindex persist

To enable ifIndex values in the Interfaces MIB (IF-MIB) that persist across reboots (ifIndex persistence) on a specific interface, use the snmp ifindex persist command. To disable ifIndex persistence only on a specific interface, use the no form of this command.

snmp ifindex persist

no snmp ifindex persist

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switches.

Usage Guidelines

Interface index persistence occurs when ifIndex values in the IF-MIB persist across reboots and allow for consistent identification of specific interfaces using SNMP.

The snmp-server ifindex persist global configuration command enables and disables ifIndex persistence for all interfaces on the routing device. This action applies only to interfaces that have ifDescr and ifIndex entries in the ifIndex table of the IF-MIB.

Examples

This example shows how to enable ifIndex persistence for interface FastEthernet 1/1 only:

(Optional) Controls all the traps defined in CISCO-STP-EXTENSIONS-MIB notifications.

vlancreate

(Optional) Controls the SNMP VLAN created trap notifications.

vlandelete

(Optional) Controls the SNMP VLAN deleted trap notifications.

vtp

(Optional) Controls the SNMP VTP trap notifications.

mac-notification

(Optional) Controls the SNMP MAC trap notifications.

change

(Optional) Controls the SNMP MAC change trap notifications.

move

(Optional) Controls the SNMP MAC move trap notifications.

threshold

(Optional) Controls the SNMP MAC threshold trap notifications.

Defaults

SNMP notifications are disabled.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(31)SG

Support for MAC notification was added.

Usage Guidelines

If you enter this command without an option, all notification types controlled by this command are enabled.

SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests for the specified notification types. To specify whether the notifications should be sent as traps or informs, use the snmp-server host [ traps | informs ] command.

The snmp-server enable traps command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send notifications, you must configure at least one snmp-server host command.

This list of the MIBs is used for the traps:

flash— Controls SNMP FLASH traps from the CISCO-FLASH-MIB.

– insertion —Controls the SNMP Flash insertion trap notifications.

– removal —Controls the SNMP Flash removal trap notifications.

fru-ctrl— Controls the FRU control traps from the CISCO-ENTITY-FRU-CONTROL-MIB.

port-security— Controls the port-security traps from the CISCO-PORT-SECURITY-MIB.

stpx— Controls all the traps from the CISCO-STP-EXTENSIONS-MIB.

vlancreate— Controls SNMP VLAN created trap notifications.

vlandelete— Controls SNMP VLAN deleted trap notifications.

vtp— Controls the VTP traps from the CISCO-VTP-MIB.

Examples

This example shows how to send all traps to the host is specified by the name myhost.cisco.com using the community string defined as public:

SNMP traps can be enabled with a rate-limit to detect port-security violations due to restrict mode. The following example shows how to enable traps for port-security with a rate of 5 traps per second:

snmp-server ifindex persist

To globally enable ifIndex values that will remain constant across reboots for use by SNMP, use the snmp-server ifindex persist command. To globally disable inIndex persistence, use the no form of this command.

snmp-server ifindex persist

no snmp-server ifindex persist

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switches.

Usage Guidelines

Interface index persistence occurs when ifIndex values in the IF-MIB persist across reboots and allow for consistent identification of specific interfaces using SNMP.

Entering the no snmp-server ifindex persist global configuration command enables and disables ifIndex persistence for all interfaces on the routing device using ifDescr and ifIndex entries in the ifIndex table of the IF-MIB.

Examples

This example shows how to enable ifIndex persistence for all interfaces:

Enables ifIndex values that will remain constant across reboots for use by SNMP.

snmp trap mac-notification change

To enable SNMP MAC address notifications, use the snmp trap mac-notification command. To return to the default setting, use the no form of this command.

snmp trap mac-notification change { added | removed }

no snmp trap mac-notification change { added | removed }

Syntax Description

added

Specifies enabling the MAC address notification trap whenever a MAC address is added to an interface.

removed

Specifies enabling the MAC address notification trap whenever a MAC address is removed from an interface.

Defaults

MAC address addition and removal are disabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.2(31)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Even though you enable the change notification trap for a specific interface by using the snmp trap mac-notification change command, the trap is generated only when you enable the snmp-server enable traps mac-notification change and the mac address-table notification change global configuration commands.

Examples

This example shows how to enable the MAC notification trap when a MAC address is added to a port:

source-interface

To send out call home email messages with specific source interface, use the source-interface command.

source-interface interface name

Syntax Description

interface name

Source interface name for call home email messages

Defaults

None

Command Modes

cfg-call-home

Command History

Release

Modification

15.0(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

You should configure no shut on an interface and provide a valid IP address before specifying it as a source interface for Call Home. Doing this avoids a connection failure when sending Call Home email messages. You should only specify a source interface name under Call Home if source-ip-address is not specified. You can only specify either a source interface or source-ip-address in call-home mode, not simultaneously.

Examples

This example shows how to configure source interface for Call Home. Generally, the interface should already be configured with a valid IP address as usually configured for an interface.

NoteIf Call Home is configured to use http or https as the transport method, you must use ip http client source-interface to configure the source interface for all http clients. You cannot specify a source interface for Call Home http messages only.

Related Commands

source-ip-address

To send out Call Home email messages with specific source IP address, use the source-ip-address command.

source-ip-address ip address

Syntax Description

ip address

Source IP address for Call Home messages.

Defaults

None

Command Modes

cfg-call-home

Command History

Release

Modification

15.0(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

It is best to configure no shut an interface with this valid IP address before specifying it as source-ip-address for Call Home. Doing this avoids a connection failure when sending Call Home email messages. You should only specify source-ip-address under Call Home if source-interface is not specified. You can only specify either source interface or source-ip-address in Call Home mode, not both simultaneously.

spanning-tree bpdufilter

To enable BPDU filtering on an interface, use the spanning-tree bpdufilter command. To return to the default settings, use the no form of this command.

spanning-tree bpdufilter { enable | disable }

no spanning-tree bpdufilter

Syntax Description

enable

Enables BPDU filtering on this interface.

disable

Disables BPDU filtering on this interface.

Defaults

Disabled

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch..

Usage Guidelines

Caution Use care when entering the
spanning-tree bpdufilter enable command. Enabling BPDU filtering on an interface is approximately equivalent to disabling the spanning tree for this interface. It is possible to create bridging loops if this command is not correctly used.

When configuring Layer 2 protocol tunneling on all the service provider edge switches, you must enable spanning-tree BPDU filtering on the 802.1Q tunnel ports by entering the spanning-tree bpdufilter enable command.

BPDU filtering allows you to prevent a port from sending and receiving BPDUs. The configuration is applicable to the whole interface, whether it is trunking or not. This command has three states:

spanning-tree bpdufilter enable — This state unconditionally enables the BPDU filter feature on the interface.

spanning-tree bpdufilter disable — This state unconditionally disables the BPDU filter feature on the interface.

no spanning-tree bpdufilter — This state enables the BPDU filter feature on the interface if the interface is in operational PortFast state and if the spanning-tree portfast bpdufilter default command is configured.

Examples

This example shows how to enable the BPDU filter feature on this interface:

Related Commands

spanning-tree bpduguard

To enable BPDU guard on an interface, use the spanning-tree bpduguard command. To return to the default settings, use the no form of this command.

spanning-tree bpduguard { enable | disable }

no spanning-tree bpduguard

Syntax Description

enable

Enables BPDU guard on this interface.

disable

Disables BPDU guard on this interface.

Defaults

BPDU guard is disabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

BPDU guard is a feature that prevents a port from receiving BPDUs. This feature is typically used in a service provider environment where the administrator wants to prevent an access port from participating in the spanning tree. If the port still receives a BPDU, it is put in the ErrDisable state as a protective measure. This command has three states:

spanning-tree bpduguard enable — This state unconditionally enables BPDU guard on the interface.

spanning-tree bpduguard disable — This state unconditionally disables BPDU guard on the interface.

Related Commands

spanning-tree cost

To calculate the path cost of STP on an interface, use the spanning-tree cost command. To revert to the default, use the no form of this command.

spanning-tree cost cost

no spanning-tree cost cost

Syntax Description

cost

Path cost; valid values are from 1 to 200,000,000.

Defaults

The default settings are as follows:

FastEthernet—19

GigabitEthernet—1

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

When you configure the cost, the higher values indicate higher costs. The range applies regardless of the protocol type that is specified. The path cost is calculated, based on the interface bandwidth.

Examples

This example shows how to access an interface and set a path cost value of 250 for the spanning-tree VLAN that is associated with that interface:

spanning-tree etherchannel guard misconfig

To display an error message when a loop due to a channel misconfiguration is detected, use the spanning-tree etherchannel guard misconfig command. To disable the feature, use the no form of this command.

spanning-tree etherchannel guard misconfig

no spanning-tree etherchannel guard misconfig

Syntax Description

This command has no arguments or keywords.

Defaults

Spanning-tree EtherChannel guard is enabled.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

When an EtherChannel guard misconfiguration is detected, this message is displayed:

%SPANTREE-2-CHNL_MISCFG:Detected loop due to etherchannel misconfig of interface Port-Channel1

To determine which local ports are involved in the misconfiguration, enter the show interfaces status err-disabled command. To verify the EtherChannel configuration on the remote device, enter the show etherchannel summary command on the remote device.

After you correct the configuration, enter the shutdown and the no shutdown commands on the associated port-channel interface.

Examples

This example shows how to enable the EtherChannel guard misconfiguration feature:

Related Commands

Displays the interface status or a list of interfaces in error-disabled state.

shutdown (refer to Cisco IOS documentation)

Disables a port.

spanning-tree extend system-id

To enable the extended system ID feature on a chassis that supports 1024 MAC addresses, use the spanning-tree extend system-id command. To disable the feature, use the no form of this command.

spanning-tree extend system-id

no spanning-tree extend system-id

Syntax Description

This command has no arguments or keywords.

Defaults

E nabled on systems that do not provide 1024 MAC addresses.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Releases 12.1(13)E and later support chassis with 64 or 1024 MAC addresses. For chassis with 64 MAC addresses, STP uses the extended system ID plus a MAC address to make the bridge ID unique for each VLAN.

You cannot disable the extended system ID on chassis that support 64 MAC addresses.

Enabling or disabling the extended system ID updates the bridge IDs of all active STP instances, which might change the spanning-tree topology.

Related Commands

spanning-tree link-type

To configure a link type for a port, use the spanning-tree link-type command. To return to the default settings, use the no form of this command.

spanning-tree link-type { point-to-point | shared }

no spanning-tree link-type

Syntax Description

point-to-point

Specifies that the interface is a point-to-point link.

shared

Specifies that the interface is a shared medium.

Defaults

Link type is derived from the duplex mode.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch..

Usage Guidelines

RSTP+ fast transition works only on point-to-point links between two bridges.

By default, the switch derives the link type of a port from the duplex mode. A full-duplex port is considered as a point-to-point link while a half-duplex configuration is assumed to be on a shared link.

If you designate a port as a shared link, RSTP+ fast transition is forbidden, regardless of the duplex setting.

Related Commands

spanning-tree mode

To switch between PVST+ and MST modes, use the spanning-tree mode command. To return to the default settings, use the no form of this command.

spanning-tree mode { pvst | mst | rapid-pvst }

no spanning-tree mode { pvst | mst | rapid-pvst }

Syntax Description

pvst

Specifies PVST+ mode.

mst

Specifies MST mode.

rapid-pvst

Specifies Rapid PVST mode.

Defaults

PVST+ mode

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch..

12.1(19)EW

Support for the rapid-pvst keyword.

Usage Guidelines

Caution Be careful when using the
spanning-tree mode command to switch between PVST+ and MST modes. When you enter the command, all spanning-tree instances are stopped for the previous mode and restarted in the new mode. Using this command may cause disruption of user traffic.

Examples

This example shows how to switch to MST mode:

Switch(config)# spanning-tree mode mstSwitch(config)#

This example shows how to return to the default mode (PVST):

Switch(config)# no spanning-tree modeSwitch(config)#

Related Commands

spanning-tree mst

To set the path cost and port-priority parameters for any MST instance (including the CIST with instance ID 0), use the spanning-tree mst command. To return to the default settings, use the no form of this command.

spanning-tree mst instance-id [ cost cost ] | [ port-priority prio ]

no spanning-tree mst instance-id { cost | port-priority }

Syntax Description

instance-id

Instance ID number; valid values are from 0 to 15.

cost cost

(Optional) Specifies the path cost for an instance; valid values are from 1 to 200000000.

port-priority prio

(Optional) Specifies the port priority for an instance; valid values are from 0 to 240 in increments of 16.

Defaults

Port priority is 128 .

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

The higher cost cost values indicate higher costs. When entering the cost value, do not include a comma in the entry; for example, enter 1000 , not 1,000 .

Usage Guidelines

By default, the value for the MST configuration is the default value for all its parameters.

The abort and exit commands allow you to exit the MST configuration submode. The difference between the two commands depends on whether you want to save your changes or not.

The exit command commits all the changes before leaving MST configuration submode. If you do not map the secondary VLANs to the same instance as the associated primary VLAN, when you exit the MST configuration submode, a message displays and lists the secondary VLANs that are not mapped to the same instance as the associated primary VLAN. The message is as follows:

These secondary vlans are not mapped to the same instance as their primary:->3

The abort command leaves the MST configuration submode without committing any changes.

Whenever you change an MST configuration submode parameter, it can cause a loss of connectivity. To reduce the number of service disruptions, when you enter the MST configuration submode, you are changing a copy of the current MST configuration. When you are done editing the configuration, you can apply all the changes at once by using the exit keyword, or you can exit the submode without committing any change to the configuration by using the abort keyword.

In the unlikely event that two users enter a new configuration at exactly at the same time, this message is displayed:

Switch(config-mst)# exit% MST CFG:Configuration change lost because of concurrent accessSwitch(config-mst)#

Examples

This example shows how to enter the MST configuration submode:

Switch(config)# spanning-tree mst configurationSwitch(config-mst)#

This example shows how to reset the MST configuration to the default settings:

Related Commands

spanning-tree mst root

To designate the primary root, secondary root, bridge priority, and timer value for an instance, use the spanning-tree mst root command. To return to the default settings, use the no form of this command.

Syntax Description

Sets a high enough priority (low value) to make the bridge root of the spanning-tree instance.

secondary

Designates this switch as a secondary root if the primary root fails.

priority prio

Sets the bridge priority; see the “Usage Guidelines” section for valid values and additional information.

diameter dia

(Optional) Sets the timer values for the bridge based on the network diameter; valid values are from 2 to 7.

hello-time hello

(Optional) Specifies the duration between the generation of configuration messages by the root switch.

Defaults

Bridge priority is 32768.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch..

Usage Guidelines

The bridge priority can be set in increments of 4096 only. When you set the priority, valid values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440.

You can set the priority to 0 to make the switch root.

The spanning-tree root secondary bridge priority value is 16384.

The diameter dia and hello-time hello options are available for instance 0 only.

If you do not specify the hello_time value, the value is calculated from the network diameter.

Examples

This example shows how to set the priority and timer values for the bridge:

Related Commands

spanning-tree portfast (interface configuration mode)

To enable PortFast mode, where the interface is immediately put into the forwarding state upon linkup without waiting for the timer to expire, use the spanning-tree portfast command. To return to the default setting, use the no form of this command.

spanning-tree portfast { disable | trunk }

no spanning-tree portfast

Syntax Description

disable

Disables PortFast on the interface.

trunk

Enables PortFast on the interface even while in the trunk mode.

Defaults

PortFast mode is disabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch..

12.1(12c)EW

The disable and trunk options were added.

Usage Guidelines

You should use this feature only with interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.

An interface with PortFast mode enabled is moved directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-time delay.

Be careful when using the no spanning-tree portfast command. This command does not disable PortFast if the spanning-tree portfast default command is enabled.

Note If you enter the spanning-tree portfast trunk command, the port is configured for PortFast even when in the access mode.

no spanning-tree portfast —This command implicitly enables PortFast if the spanning-tree portfast default command is defined in global configuration and if the port is not a trunk port. If you do not configure PortFast globally, the no spanning-tree portfast command is equivalent to the spanning-tree portfast disable command.

Usage Guidelines

You can override the effects of the spanning-tree portfast bpdufilter default command by configuring BPDU filtering at the interface level.

NoteBe careful when enabling BPDU filtering. Functionality is different when enabling on a per-port basis or globally. When enabled globally, BPDU filtering is applied only on ports that are in an operational PortFast state. Ports still send a few BPDUs at linkup before they effectively filter outbound BPDUs. If a BPDU is received on an edge port, it immediately loses its operational PortFast status and BPDU filtering is disabled.

When enabled locally on a port, BPDU filtering prevents the Catalyst 4500 series switch from receiving or sending BPDUs on this port.

Caution Be careful when using this command. This command can cause bridging loops if not used correctly.

Related Commands

spanning-tree portfast bpduguard default

To enable BPDU guard by default on all the PortFast ports, use the spanning-tree portfast bpduguard default command. To return to the default settings, use the no form of this command.

spanning-tree portfast bpduguard default

no spanning-tree portfast bpduguard default

Syntax Description

This command has no keywords or arguments.

Defaults

BPDU guard is disabled.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Caution Use this command only with the interfaces that connect to the end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.

BPDU guard disables a port if it receives a BPDU. BPDU guard is applied only on ports that are PortFast enabled and are in an operational PortFast state.

Related Commands

spanning-tree portfast default

To globally enable PortFast by default on all access ports, use the spanning-tree portfast default command. To disable PortFast as default on all access ports, use the no form of this command.

spanning-tree portfast default

no spanning-tree portfast default

Syntax Description

This command has no arguments or keywords.

Defaults

PortFast is disabled.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Caution Use this command only with the interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.

An interface with PortFast mode enabled is moved directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-time delay.

Related Commands

spanning-tree port-priority

To prioritize an interface when two bridges compete for position as the root bridge, use the spanning-tree port-priority command. The priority you set resolves the conflict. To revert to the default setting, use the no form of this command.

spanning-tree port-priority port_priority

no spanning-tree port-priority

Syntax Description

port_priority

Port priority; valid values are from 0 to 240 in increments of 16.

Defaults

Port priority value is set to 128.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Examples

This example shows how to increase the possibility that the spanning-tree instance 20 will be chosen as the root-bridge on interface FastEthernet 2/1:

spanning-tree uplinkfast

To enable the UplinkFast feature, use the spanning-tree uplinkfast command. To disable UplinkFast, use the no form of this command.

spanning-tree uplinkfast [ max-update-rate packets-per-second ]

no spanning-tree uplinkfast [ max-update-rate ]

Syntax Description

max-update-rate packets_per_second

(Optional) Specifies the maximum rate (in packets per second) at which update packets are sent; valid values are from 0 to 65535.

Defaults

The default settings are as follows:

Disabled.

Maximum update rate is 150.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

This command should be used only on access switches.

When UplinkFast is configured, the bridge priority is changed to 49,152 so that this switch will not be selected as root. All interface path costs of all spanning-tree interfaces belonging to the specified spanning-tree instances are also increased by 3000.

When spanning tree detects that the root interface has failed, the UplinkFast feature causes an immediate switchover to an alternate root interface, transitioning the new root interface directly to the forwarding state. During this time, a topology change notification is sent. To minimize the disruption caused by the topology change, a multicast packet is sent to 01-00-0C-CD-CD-CD for each station address in the forwarding bridge except for those associated with the old root interface.

Use the spanning-tree uplinkfast max-update-rate command to enable UplinkFast (if not already enabled) and change the rate at which the update packets are sent. Use the no form of this command to return the default rate of 150 packets per second.

Examples

This example shows how to enable UplinkFast and set the maximum rate to 200 packets per second:

Syntax Description

(Optional) Specifies, in seconds, the time between configuration messages generated by the root switch; valid values are from 1 to 10 seconds.

max-age seconds

(Optional) Sets the maximum time, in seconds, that the information in a BPDU is valid; valid values are from 6 to 40 seconds.

priority priority

(Optional) Sets the STP bridge priority; valid values are from 0 to 65535.

protocol protocol

(Optional) Specifies the protocol.

root primary

(Optional) Forces this switch to be the root bridge.

root secondary

(Optional) Specifies this switch act as the root switch should the primary root fail.

diameter net-diameter

(Optional) Specifies the maximum number of bridges between two end stations; valid values are from 2 to 7.

Defaults

The default settings are as follows:

Forward-time—15 seconds

Hello-time—2 seconds

Max-age—20 seconds

Priority—32768 with STP enabled; 128 with MST enabled

Root—No STP root

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

Usage Guidelines

When you are setting the max-age seconds value , if a bridge does not hear BPDUs from the root bridge within the specified interval, it assumes that the network has changed and recomputes the spanning-tree topology.

The spanning-tree root primary command alters the switch bridge priority to 8192. If you enter the spanning-tree root primary command and the switch does not become root, then the bridge priority is changed to 100 less than the bridge priority of the current bridge. If the switch does not become root, an error will result.

The spanning-tree root secondary command alters the switch bridge priority to 16384. If the root switch fails, this switch becomes the next root switch.

Use the spanning-tree root commands on backbone switches only.

Examples

This example shows how to enable spanning tree on VLAN 200:

Switch(config)# spanning-tree vlan 200 Switch(config)#

This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4:

If the speed is set to 10 or 100 and you do not configure the duplex setting, the duplex is set to half.

100-Mbps fiber modules

Not applicable.

Not applicable.

Not applicable.

Gigabit Ethernet Interface

speed nonegotiate

nonegotiate is enabled.

This is only applicable to Gigabit Ethernet ports.

10/100/1000

speed [ 10 | 100 | 1000 | auto ]

auto

If the speed is set to 10 or 100 and you do not configure the duplex setting, the duplex is set to half.

If the speed is set to 1000 or auto with any subset containing 1000 (e.g. speed auto 10 1000 or speed auto on a 10/100/1000 port), you will not able to set half duplex.

1000

Not applicable.

Not applicable.

The speed is always 1000.

The duplex is half.

If you configure the interface speed and duplex commands manually and enter a value other than speed auto (for example, 10 or 100 Mbps), make sure that you configure the connecting interface speed command to a matching speed but do not use the auto param eter.

When manually configuring the interface speed to either 10 or 100 Mbps, the switch prompts you to also configure duplex mode on the interface.

NoteCatalyst 4506 switches cannot automatically negotiate the interface speed and the duplex mode if either connecting interface is configured to a value other thanauto.

Caution Changing the interface speed and the duplex mode configuration might shut down and reenable the interface during the reconfiguration.

Table 2-45 describes the system’s performance for different combinations of the duplex and speed modes. The specified duplex command that is configured with the specified speed command produces the resulting system action.

Table 2-45 System Action Using duplex and speed Commands

duplex Command

speed Command

Resulting System Action

duplex auto

speed auto

Autonegotiates both speed and duplex modes

duplex half

speed 10

Forces 10 Mbps and half duplex

duplex full

speed 10

Forces 10 Mbps and full duplex

duplex half

speed 100

Forces 100 Mbps and half duplex

duplex full

speed 100

Forces 100 Mbps and full duplex

duplex full

speed 1000

Forces 1000 Mbps and full duplex

Examples

This example shows how to set the interface speed to 100 Mbps on the Fast Ethernet interface 5/4:

storm-control

To enable broadcast storm control on a port and to specify what to do when a storm occurs on a port, use the storm-control interface configuration command. To disable storm control for the broadcast traffic and to disable a specified storm-control action, use the no form of this command.

Syntax Description

broadcast

Enables the broadcast storm control on the port.

level high-level lower-level

Defines the rising and falling suppression levels:

high-level —Rising suppression level as a percent of total bandwidth, up to two decimal places; valid values are from 0 to 100 percent. Blocks the flooding of storm packets when the value specified for level is reached.

lower-level —(Optional) Falling suppression level as a percent of total bandwidth, up to two decimal places; valid values are from 0 to 100. This value must be less than the rising suppression value.

action

Directs the switch to take action when a storm occurs on a port.

shutdown

Disables the port during a storm.

trap

Sends an SNMP trap when a storm occurs. This keyword is available but not supported in 12.1(19)EW.

Defaults

Broadcast storm control is disabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(40)SG

Support introduced for Supervisor Engine 6-E and Catalyst 4900M.

Usage Guidelines

Enter the storm-control broadcast level command to enable traffic storm control on the interface, configure the traffic storm control level, and apply the traffic storm control level to the broadcast traffic on the interface.

The Catalyst 4500 series switch supports broadcast traffic storm control on all LAN ports.

The period is required when you enter the fractional suppression level.

The suppression level is entered as a percentage of the total bandwidth. A threshold value of 100 percent indicates that no limit is placed on traffic. A value of 0.0 means that all specified traffic on that port is blocked.

Command History

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(40)SG

Support introduced for Catalyst 4900M and Supervisor Engine 6-E.

Usage Guidelines

This command prompts the hardware to filter multicast packets if it is already filtering broadcast packets.

The Catalyst 4500 series switch support per-interface multicast suppression. When you enable multicast suppression on an interface you subject incoming multicast and broadcast traffic on that interface to suppression.

Examples

This example shows how to enable multicast storm control globally:

Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# storm-control broadcast include multicastSwitch(config)# end

This example shows how to enable per-port Multicast storm control on a Supervisor Engine 6-E:

Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet2/4Switch(config-if)# storm-control broadcast include multicastSwitch(config)# end

Usage Guidelines

You can configure the Syslog alert group can be configured to filter messages based on severity by specifying a pattern to be matched in the syslog message. If the pattern contains spaces, you must enclose it in quotes (“”).

Examples

This example shows how to configure the syslog alert group with severity notification:

Related Commands

switch convert mode (virtual switch)

To select the switch mode, use the switch convert mode command in privileged EXEC mode.

switch convert mode {easy-virtual-switch | stand-alone | virtual}

Syntax Description

easy-virtual-switch

Specifies execution on the standalone switch, which will be made the master, and switches to easy-vss mode.

stand-alone

Specifies standalone mode.

virtual

Specifies virtual switch mode.

Defaults

stand-alone

Command Modes

Privileged EXEC mode

Command History

Release

Modification

Cisco IOS XE 3.4.0SG and 15.1(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Cisco IOS XE 3.6.0E and 15.2(2)E

easy-virtual-switch keyword introduced.

Usage Guidelines

You must reboot both switches when you convert a switch to virtual switch mode.

You execute the switch convert mode easy-virtual-switch command on the Catalyst 4500 switch intended as the “master” after the switch boots and comes up as VSS. In the easy-vss sub-exec mode, you specify the local interfaces [of the switch where the command is executed] that you want to select as a VSL interface.

In a VSS, the interface naming convention includes the switch number. For example, you must use switch/module/port to specify a port on a switching module. The switch convert mode virtual command converts the configuration file to use the VSS naming convention, and saves a backup copy of the file in the RP bootflash.

NoteAfter you confirm the command (with yes at the prompt), the switch converts the configuration file and restarts both chassis. Subsequently, the chassis is in virtual switch mode and you must specify interfaces with three identifiers (switch/module/port).

A no form of this command does not exist. You must specify either stand-alone or virtual mode.

You can enter the switch convert mode virtual command only after the standby switch is fully operational (in hot standby mode). If you enter the command before the standby switch is fully operational, a message is displayed telling you to try again later.

NoteIf you have configured your config-register with a value that would skip file parsing during the bootup process, your change to either a standalone or virtual switch will not take place until you reconfigure your config-register. The config-register must be allowed to parse files to ensure a conversion from either a standalone or virtual switch.

Examples

This example shows how to converts a switch to the “master” after the switch boots and comes up as VSS. In the easy-vss sub-exec mode, you specify the local interfaces GigabitEthernet3/5 [of the switch where the command is executed] that you want to select as a VSL interface:

switch virtual domain (virtual switch)

To configure the virtual switch domain number and enter the virtual switch domain configuration submode, use the switch virtual domain command in global configuration mode.

switch virutal domain number

Syntax Description

number

Specifies the virtual switch domain number. Range: 1 to 255.

Defaults

No virtual switch domain number is configured.

Command Modes

Global configuration (config)

Command History

Release

Modification

Cisco IOS XE 3.4.0SG and 15.1(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

When you enter the switch virtual domain command, you enter the virtual switch domain configuration submode, and the prompt changes to Router1(config-vs-domain)#. Within the virtual switch domain configuration submode, the following commands are available:

default—Sets a command to its defaults.

exit—Exits the virtual-switch-domain-mode and returns to the global configuration mode.

You must configure the same virtual switch domain number on both chassis of the virtual switch. The virtual switch domain is a number between 1 and 255, and must be unique for each virtual switch in your network.

Related Commands

switch virtual link (virtual switch)

To associate a switch to an interface, use the switch virtual link command in interface configuration mode.

switch virutal link switch-number

Syntax Description

switch-umber

Switch number; valid values are 1 and 2.

Defaults

The interfaces are not associated by default.

Command Modes

Interface configuration (config-if)

Command History

Release

Modification

Cisco IOS XE 3.4.0SG and 15.1(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

The virtual switch link (VSL) is configured with a unique port channel on each chassis. You must add the VSL physical ports to the port channel. The VSL channel group must contain a minimum of two ports.

Examples

The following example shows how to associate switch 2 to a port channel:

switchport

To modify the switching characteristics of a Layer 2 switch interface, use the switchport command. To return the interface to the routed-interface status and cause all further Layer 2 configuration to be erased, use the no form of this command without parameters.

Syntax Description

(Optional) Sets the VLAN when the interface is in access mode; valid values are from 1 to 1005.

nonegotiate

(Optional) Specifies that the DISL/DTP negotiation packets will not be sent on the interface.

voice vlan vlan_id

(Optional) Specifies the number of the VLAN; valid values are from 1 to 1005.

dot1p

(Optional) Specifies that the PVID packets are tagged as priority.

none

(Optional) Specifies that the telephone and voice VLAN do not communicate.

untagged

(Optional) Specifies the untagged PVID packets.

Defaults

The default settings are as follows:

Switchport trunking mode is enabled.

Dynamic negotiation parameter is set to auto .

Access VLANs and trunk interface native VLANs are a default VLAN corresponding to the platform or interface hardware.

All VLAN lists include all VLANs.

No voice VLAN is enabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(11)EW

Support for voice VLAN was added.

Usage Guidelines

The no switchport command shuts the port down and then reenables it, which may generate messages on the device to which the port is connected.

The no form of the switchport access command resets the access mode VLAN to the appropriate default VLAN for the device. The no form of the switchport nonegotiate command removes the nonegotiate status.

When you are using the nonegotiate keyword, DISL/DTP negotiation packets will not be sent on the interface. The device will trunk or not trunk according to the mode parameter given: access or trunk. This command will return an error if you attempt to execute it in dynamic (auto or desirable) mode.

The voice VLAN is automatically set to VLAN 1 unless you use one of the optional keywords.

If you use the switch port voice vlan command for an interface, the interface cannot join a port channel.

When you use the switchport voice vlan command, the output for the show running-config command changes to show the voice VLAN set.

Examples

This example shows how to cause the port interface to stop operating as a Cisco-routed port and convert to a Layer 2-switched interface:

Switch(config-if)# switchportSwitch(config-if)#

This example shows how to cause a port interface in access mode, which is configured as a switched interface, to operate in VLAN 2:

Switch(config-if)# switchport access vlan 2Switch(config-if)#

This example shows how to cause a port interface, which is configured as a switched interface, to refrain from negotiating in trunking mode and act as a trunk or access port (depending on the mode set):

Switch(config-if)# switchport nonegotiateSwitch(config-if)#

This example shows how to set the voice VLAN for the interface to VLAN 2:

Related Commands

Displays the administrative and operational status of a switching (nonrouting) port.

switchport access vlan

To set the VLAN when an interface is in access mode, use the switchport access vlan command. To reset the access mode VLAN to the appropriate default VLAN for the device, use the no form of this command.

switchport access [ vlan { vlan-id | dynamic }]

no switchport access vlan

Syntax Description

vlan-id

(Optional) Number of the VLAN on the interface in access mode; valid values are from 1 to 4094.

dynamic

(Optional) Enables VMPS control of the VLAN.

Defaults

The default settings are as follows:

The access VLAN and trunk interface native VLAN are default VLANs that correspond to the platform or the interface hardware.

All VLAN lists include all VLANs.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(13)EW

Support for VPMS was added.

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport access vlan command. This action is required only if you have not already entered the switchport command for the interface.

Entering the no switchport command shuts the port down and then reenables it, which could generate messages on the device to which the port is connected.

The no form of the switchport access vlan com mand resets the access mode VLAN to the appropriate default VLAN for the device.

Valid values for vlan-id are from 1 to 4094.

Examples

This example shows how to cause the port interface to stop operating as a Cisco-routed port and convert to a Layer 2-switched interface:

Switch(config-if)# switchportSwitch(config-if)#

NoteThis command is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2-switched interfaces.

This example shows how to cause a port interface that has already been configured as a switched interface to operate in VLAN 2 instead of the platform’s default VLAN when in access mode:

Related Commands

Displays the administrative and operational status of a switching (nonrouting) port.

switchport autostate exclude

To exclude a port from the VLAN interface link-up calculation, use the switchport autostate exclude command. To return to the default settings, use the no form of this command.

switchport autostate exclude

no switchport autostate exclude

Syntax Description

This command has no keywords or arguments.

Defaults

All ports are included in the VLAN interface link-up calculation.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.2(37)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport autostate exclude command. This action is required only if you have not entered the switchport command for the interface.

NoteTheswitchport command is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2-switched interfaces.

The switchport autostate exclude command marks the port to be excluded from the interface VLAN up calculation when there are multiple ports in the VLAN.

The show interface interface switchport command displays the autostate mode if the mode has been set. If the mode has not been set, the autostate mode is not displayed.

Examples

This example shows how to exclude a port from the VLAN interface link-up calculation:

Switch(config-if)# switchport autostate excludeSwitch(config-if)#

This example shows how to include a port in the VLAN interface link-up calculation:

Switch(config-if)# no switchport autostate excludeSwitch(config-if)#

You can verify your settings by entering the show interfaces switchport privileged EXEC command.

Related Commands

Displays the administrative and operational status of a switching (nonrouting) port.

switchport block

To prevent the unknown multicast or unicast packets from being forwarded, use the switchport block interface configuration command. To allow the unknown multicast or unicast packets to be forwarded, use the no form of this command.

switchport block { multicast | unicast }

no switchport block { multicast | unicast }

Syntax Description

multicast

Specifies that the unknown multicast traffic should be blocked.

unicast

Specifies that the unknown unicast traffic should be blocked.

Defaults

Unknown multicast and unicast traffic are not blocked.

All traffic with unknown MAC addresses is sent to all ports.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

You can block the unknown multicast or unicast traffic on the switch ports.

Blocking the unknown multicast or unicast traffic is not automatically enabled on the switch ports; you must explicitly configure it.

NoteFor more information about blocking the packets, refer to the software configuration guide for this release.

Examples

This example shows how to block the unknown multicast traffic on an interface:

Switch(config-if)# switchport block multicast

You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command.

(Optional) Sets the security violation shutdown mode. In this mode, a port security violation causes the interface to immediately become error disabled.

shutdown vlan

(Optional) Set the security violation mode to per-VLAN shutdown. In this mode, only the VLAN on which the violation occurred is error-disabled.

Defaults

The default settings are as follows:

Port security is disabled.

When port security is enabled and no keywords are entered, the default maximum number of secure MAC addresses is 1.

Aging is disabled.

Aging time is 0 minutes.

All secure addresses on this port age out immediately after they are removed from the secure address list.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(19)EW

Extended to include DHCP snooping security enhancement.

12.2(18)EW

Added support for sticky interfaces.

12.2(31)SG

Added support for sticky port security.

12.2(52)SG

Added support for per-VLAN error-disable detection.

Usage Guidelines

After you set the maximum number of secure MAC addresses that are allowed on a port, you can add secure addresses to the address table by manually configuring them, by allowing the port to dynamically configure them, or by configuring some MAC addresses and allowing the rest to be dynamically configured.

The packets are dropped into the hardware when the maximum number of secure MAC addresses are in the address table and a station that does not have a MAC address in the address table attempts to access the interface.

If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you set the maximum allowed secure addresses on the port to more than 1.

You cannot configure static secure MAC addresses in the voice VLAN.

A secure port has the following limitations:

A secure port cannot be a dynamic access port or a trunk port.

A secure port cannot be a routed port.

A secure port cannot be a protected port.

A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

When a secure port is in the error-disabled state, you can remove it from this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands. If a port is is disabled, you can also use the clear errdisable command to re-enable the offending VLAN on the port.

To enable secure address aging for a particular port, set the aging time to a value other than 0 for that port.

To allow limited time access to particular secure addresses, set the aging type as absolute . When the aging time lapses, the secure addresses are deleted.

To allow continuous access to a limited number of secure addresses, set the aging type as inactivity . This action removes the secure address when it becomes inactive, and other addresses can become secure.

To allow unlimited access to a secure address, configure it as a secure address, and disable aging for the statically configured secure address by using the no switchport port-security aging static interface configuration command.

If the sticky command is executed without a MAC address specified, all MAC addresses that are learned on that port will be made sticky. You can also specify a specific MAC address to be a sticky address by entering the sticky keyword next to it.

You can configure the sticky feature even when port security is not enabled on the interface. The feature becomes operational when you enable port security on the interface.

You can use the no form of the sticky command only if the sticky feature is already enabled on the interface.

Examples

This example shows how to set the aging time to 2 hours (120 minutes) for the secure addresses on the Fast Ethernet port 12:

NoteThis command makes all sticky addresses on this interface normal learned entries. It does not delete the entries from the secure MAC address table.

NoteThe following examples show how to configure sticky secure MAC addresses in access and voice VLANs on interfaces with voice VLAN configured. If you do not have voice VLAN configured thevlan [access | voice] keywords are not supported.

This example shows how to configure sticky MAC addresses for voice and data VLANs on Fast Ethernet interface 5/1 and to verify the configuration:

This example shows how to designate a maximum of one MAC address for a voice VLAN (for a Cisco IP Phone, let’s say) and one MAC address for the data VLAN (for a PC, let’s say) on Fast Ethernet interface 5/1 and to verify the configuration:

Prevents the unknown multicast or unicast packets from being forwarded.

switchport private-vlan association trunk

To configure the association between a secondary VLAN and a VLAN on a private VLAN trunk port, use the switchport private-vlan association trunk command. To remove the private VLAN mapping from the port, use the no form of this command.

Defaults

Command Modes

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(20)EW

Support for community VLAN was added.

Usage Guidelines

Multiple private VLAN pairs can be specified so that a private VLAN trunk port can carry multiple secondary VLANs. If an association is specified for the existing primary VLAN, the existing association is replaced.

Only isolated secondary VLANs can be carried over a private VLAN trunk.

NoteCommunity secondary VLANs on a private VLAN trunk are not supported in this release.

If there is no trunk association, any packets received on the secondary VLANs are dropped.

Examples

This example shows how to configure a port with a primary VLAN (VLAN 18) and secondary VLAN (VLAN 20):

Syntax Description

Number of the primary VLAN of the private VLAN relationship; valid values are from 2 to 4094 (excluding 1002 to 1005).

secondary-vlan-list

Number of the secondary VLANs to map to the primary VLAN; valid values are from 2 to 4094.

add

Maps the secondary VLANs to the primary VLAN.

remove

Clears mapping between the secondary VLANs and the primary VLAN.

trunk

Maps the trunks secondary VLANs to the primary VLAN.

Defaults

Private VLAN mapping is disabled.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.1(12c)EW

Support for extended addressing was added.

12.2(20)EW

Support for community VLAN was added.

12.2(31)SG

Support for trunk VLAN was added.

Usage Guidelines

There is no run-time effect on the port unless it is in private VLAN promiscuous mode. If the port is in private VLAN promiscuous mode but the VLANs do not exist, the command is allowed, but the port is made inactive.

The secondary VLAN may be an isolated or community VLAN.

NoteThe maximum number of unique private VLAN pairs supported by the switchport private-vlan mapping trunk command above is 500. For example, one thousand secondary VLANs could map to one primary VLAN, or one thousand secondary VLANs could map one to one to one thousand primary VLANs.

Examples

This example shows how to configure the mapping of primary VLAN 18 to the secondary isolated VLAN 20 on a port:

Related Commands

switchport private-vlan trunk allowed vlan

To configure a list of the allowed normal VLANs on a private VLAN trunk port, use the switchport private-vlan trunk allowed vlan command. To remove all the allowed normal VLANs from a private VLAN trunk port, use the no form of this command.

Related Commands

switchport private-vlan trunk native vlan tag

To control the tagging of the native VLAN traffic on 802.1Q private VLAN trunks, use the switchport private-vlan trunk native vlan tag command. To remove the control of tagging (and default to the global setting), use the no form of this command.

switchport private-vlan trunk native vlan tag

no switchport private-vlan trunk native vlan tag

Syntax Description

This command has no arguments or keywords.

Defaults

The default setting is global; the settings on the port are determined by the global setting.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(18)EW

Removed vlan-id keyword.

Usage Guidelines

The configuration created with this command only applies to ports that are configured as private VLAN trunks.

Examples

This example shows how to enable 802.1Q native VLAN tagging on a PVLAN trunk:

Related Commands

switchport trunk

To set the trunk characteristics when an interface is in trunking mode, use the switchport trunk command. To reset all of the trunking characteristics back to the original defaults, use the no form of this command.

switchport trunk native vlan { tag | vlan_id }

no switchport trunk native vlan { tag | vlan_id }

switchport trunk allowed vlan vlan_list

no switchport trunk allowed vlan vlan_list

switchport trunk pruning vlan vlan_list

no switchport trunk pruning vlan vlan_list

Syntax Description

native vlan tag

Specifies the tagging of native VLAN traffic on 802.1Q trunks.

native vlan vlan_id

Sets the native VLAN for the trunk in 802.1Q trunking mode.

allowed vlan vlan_list

Sets the list of allowed VLANs that transmit this interface in tagged format when in trunking mode. See the “Usage Guidelines” section for formatting guidelines for vlan_list .

pruning vlan vlan_list

Sets the list of VLANs that are enabled for VTP pruning when the switch is in trunking mode. See the “Usage Guidelines” section for formatting guidelines for vlan_list .

Defaults

The default settings are as follows:

IOS-XE only supports dot1Q.

The access VLANs and trunk interface native VLANs are a default VLAN that corresponds to the platform or the interface hardware.

All VLAN lists include all VLANs.

Native VLAN tagging is enabled on the port if enabled globally.

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch..

Usage Guidelines

all specifies all VLANs from 1 to 4094. This keyword is not supported on commands that do not permit all VLANs in the list to be set at the same time.

none indicates an empty list. This keyword is not supported on commands that require certain VLANs to be set or at least one VLAN to be set.

add adds the defined list of VLANs to those currently set, instead of replacing the list.

remove removes the defined list of VLANs from those currently set, instead of replacing the list.

except lists the VLANs that should be calculated by inverting the defined list of VLANs.

vlan_atom is either a single VLAN number from 1 to 4094 or a continuous range of VLANs described by two VLAN numbers (the lesser one first, separated by a hyphen).

The no form of the native vlan command res ets the native mode VLAN to the appropriate default VLAN for the device.

The no form of the allowed vlan command resets the list to the default list, which allows all VLANs.

The no form of the pruning vlan command resets the list to the default list, which enables all VLANs for VTP pruning.

These configuration guidelines and restrictions apply when using 802.1Q trunks and impose some limitations on the trunking strategy for a network:

When connecting Cisco switches through an 802.1Q trunk, make sure that the native VLAN for an 802.1Q trunk is the same on both ends of the trunk link. If the native VLAN on one end of the trunk is different from the native VLAN on the other end, spanning-tree loops might result.

Disabling spanning tree on the native VLAN of an 802.1Q trunk without disabling spanning tree on every VLAN in the network can cause spanning-tree loops. We recommend that you leave spanning tree enabled on the native VLAN of an 802.1Q trunk. If this is not possible, disable spanning tree on every VLAN in the network. Make sure that your network is free of physical loops before disabling spanning tree.

When you connect two Cisco switches through 802.1Q trunks, the switches exchange spanning-tree BPDUs on each VLAN that is allowed on the trunks. The BPDUs on the native VLAN of the trunk are sent untagged to the reserved 802.1d spanning-tree multicast MAC address (01-80-C2-00-00-00). The BPDUs on all other VLANs on the trunk are sent tagged to the reserved SSTP multicast MAC address (01-00-0c-cc-cc-cd).

Non-Cisco 802.1Q switches maintain only a single instance of spanning tree (MST) that defines the spanning-tree topology for all VLANs. When you connect a Cisco switch to a non-Cisco switch through an 802.1Q trunk, the MST of the non-Cisco switch and the native VLAN spanning tree of the Cisco switch combine to form a single spanning-tree topology known as the CST.

Because Cisco switches transmit BPDUs to the SSTP multicast MAC address on the VLANs other than the native VLAN of the trunk, non-Cisco switches do not recognize these frames as BPDUs and flood them on all ports in the corresponding VLAN. Cisco switches connected to the non-Cisco 802.1Q network receive these flooded BPDUs. Because Cisco switches receive the flooded BPDUs, the switches can maintain a per-VLAN spanning-tree topology across a network of non-Cisco 802.1Q switches. The non-Cisco 802.1Q network separating the Cisco switches is treated as a single broadcast segment between all switches that are connected to the non-Cisco 802.1Q network through the 802.1Q trunks.

Ensure that the native VLAN is the same on all of the 802.1Q trunks connecting the Cisco switches to the non-Cisco 802.1Q network.

If you are connecting multiple Cisco switches to a non-Cisco 802.1Q network, all of the connections must be through the 802.1Q trunks. You cannot connect Cisco switches to a non-Cisco 802.1Q network through the ISL trunks or through the access ports. This action causes the switch to place the ISL trunk port or access port into the spanning-tree “port inconsistent” state and no traffic will pass through the port.

Follow these guidelines for native VLAN tagging:

The no switchport trunk native vlan tag command disables the native VLAN tagging operation on a port. This overrides the global tagging configuration.

The switchport trunk native vlan tag command can be used to reenable tagging on a disabled port.

The no option is saved to NVRAM so that the user does not have to manually select the ports to disable the tagging operation each time that the switch reboots.

When the switchport trunk native vlan tag command is enabled and active, all packets on the native VLAN are tagged, and incoming untagged data packets are dropped. Untagged control packets are accepted.

Examples

This example shows how to cause a port interface that is configured as a switched interface to encapsulate in 802.1Q trunking format regardless of its default trunking format in trunking mode:

Related Commands

Displays the administrative and operational status of a switching (nonrouting) port.

switchport vlan mapping

Use the switchport vlan mapping interface configuration command to configure VLAN mapping on a trunk port. You can configure one-to-one VLAN mapping, traditional IEEE 802.1Q tunneling (QinQ) mapping, or selective QinQ mapping. Use the no form of the command to disable the configuration.

Syntax Description

vlan-id

Specifies the original (customer) VLAN or VLANs (C-VLANs), also known as the VLAN on the wire, for one-to-one or selective QinQ mapping. You can enter multiple VLAN IDs separated by a comma or a series of VLAN IDs separated by a hyphen (for example 1,2,3-5). The range is from 1 to 4094.

translated-id

Specifies the translated VLAN-ID: the S-VLAN to be used in the service provider network. The range is from 1 to 4094.

dot1q-tunnel translated-id

Adds a translated VLAN-ID to specify a VLAN tunnel (add an outer S-VLAN tag). The range of the S-VLAN tag is 1 to 4094. Use these keywords for traditional QinQ mapping.

all

In the no switchport vlan mapping command, specifies that all VLAN mapping configurations on the interface are deleted.

Defaults

No VLAN mapping is configured.

Command Modes

Interface configuration

Command History

Release

Modification

12.2(54)SG

This command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Before configuring VLAN mapping on an interface, enter the switchport mode trunk interface configuration command to configure the interface as a trunk port.

You can configure VLAN mapping on a physical interface or on a port channel of multiple interfaces with the same configuration.

NoteTo avoid mixing customer traffic, when you configure traditional QinQ on a trunk port,you should use the switchport trunk allowed vlanvlan-id interface configuration command to configure the outer VLAN ID (S-VLAN) as an allowed VLAN on the trunk port.

NoteYou cannot configure one-to-one mapping and selective QinQ on the same interface.

The no form of the switchport vlan mapping commands clears the specified mapping configuration. The no switchport vlan mapping all command clears all mapping configurations on the interface.

You cannot configure encapsulation replicate on a SPAN destination port if the source port is configured as a tunnel port or has a 1-to-2 mapping configured. Encapsulation replicate is supported with 1-to-1 VLAN mapping.

Examples

This example shows how to use one-to-one mapping to map VLAN IDs 1 and 2 in the customer network to VLANs 1001 and 1002 in the service-provider network and to drop traffic from any other VLAN IDs.

This example shows how to configure selective QinQ mapping on the port so that traffic with a C-VLAN ID of 5, 7, or 8 would enter the switch with an S-VLAN ID of 100. The traffic of any other VLAN IDs is dropped.

NoteTheshowcable-diagnostictdr command is used to display the results of a TDR test. The test results will not be available until approximately 1 minute after the test starts. If you enter the showcable-diagnostictdr command within 1 minute of the test starting, you may see a “TDR test is in progress on interface...” message.

(Optional) Specifies the VLAN on which to trace the Layer 2 path that the packets take from the source switch to the destination switch; valid VLAN IDs are from 1 to 4094. Do not enter leading zeros.

detail

(Optional) Displays detail information.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Release

Modification

12.1(15)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Do not use leading zeros when entering a VLAN ID.

The Layer 2 traceroute feature is available on these switches:

Catalyst 2950 switches running Release 12.1(12c)EA1 or later

Catalyst 3550 switches running Release 12.1(12c)EA1 or later

Catalyst 4500 series switches running Catalyst operating system Release 6.2 or later for the supervisor engine

Catalyst 4500 series switches running Release 12.1(15)EW or later

Catalyst 5000 family switches running Catalyst operating system Release 6.1 or later for the supervisor engine

Catalyst 6500 series switches running Catalyst operating system Release 6.1 or later for the supervisor engine

For Layer 2 traceroute to functional properly, Cisco Discovery Protocol (CDP) must be enabled on all of the switches in the network. Do not disable CDP.

When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.

The maximum number of hops identified in the path is ten.

Layer 2 traceroute supports only unicast traffic. If you specify a multicast source or destination MAC address, the physical path is not identified, and a message appears.

The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and a message appears.

If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and a message appears.

Layer 2 traceroute is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and a message appears.

This feature is not supported in Token Ring VLANs.

Examples

This example shows how to display the Layer 2 path by specifying the source and destination MAC addresses:

Syntax Description

IP address of the source switch as a 32-bit quantity in dotted-decimal format.

destination-ip-address

IP address of the destination switch as a 32-bit quantity in dotted-decimal format.

source-hostname

IP hostname of the source switch.

destination-hostname

IP hostname of the destination switch.

detail

(Optional) Displays detailed traceroute MAC IP information.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Release

Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

The Layer 2 traceroute feature is available on these switches:

Catalyst 2950 switches running Release 12.1(12c)EA1 or later

Catalyst 3550 switches running Release 12.1(12c)EA1 or later

Catalyst 4500 series switches running Catalyst operating system Release 6.2 or later for the supervisor engine

Catalyst 4500 series switches running Release 12.1(15)EW or later

Catalyst 5000 family switches running Catalyst operating system Release 6.1 or later for the supervisor engine

Catalyst 6500 series switches running Catalyst operating system Release 6.1 or later for the supervisor engine

For Layer 2 traceroute to functional properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP.

When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.

The maximum number of hops identified in the path is ten.

The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs.

If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path.

If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. The IP addresses must be in the same subnet. If the IP address is not resolved, the path is not identified, and a message appears.

Layer 2 traceroute is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears.

This feature is not supported in Token Ring VLANs.

Examples

This example shows how to display the Layer 2 path by specifying the source and destination IP addresses and by using the detail keyword:

transport udp load-share (netflow-lite exporter submode)

NoteNetFlow-lite is only supported on the Catalyst 4948E and Catalyst 4948E-F Ethernet switches.

To specify the number of destination ports to load balance on for a NetFlow-lite collector, use the transport udp load-share command. To delete a transport UDP, use the no form of this command.

transport udp load-share destination-port

no transport udp load-share destination-port

Syntax Description

destination-port

Specifies number of destination ports to load balance on.

Defaults

1

Command Modes

netflow-lite exporter submode

Command History

Release

Modification

15.0(2)SG

Support for this command was introduced on the Catalyst 4948E and Catalyst 4948E-F Ethernet switches.

Usage Guidelines

The CLI for UDP destination port load sharing allows you leverage multiple receive packet queues in current server NICs, where the collector is running. This is an optional parameter. When number >= 2 is configured, a switch exports datagrams with a UDP destination port number that “round robins” between a set of consecutive destination UDP port numbers starting with the base udp port number and ending with base udp port number + num ports-1. Typically, netflow templates are sent on the base UDP port number and the packet sample netflow records are sent on the remaining UDP ports. So, the collector provides optimized processing for templates or metadata and packet sample records on a socket.

Examples

This example shows how to specify a UDP transport destination port for a NetFlow-lite collector:

trust

To define a trust state for traffic classified through the class policy-map configuration command, use the trust policy-map class configuration command. To return to the default setting, use the no form of this command.

trust [ cos | dscp ]

no trust [ cos | dscp ]

Syntax Description

cos

(Optional) Classifies an ingress packet by using the packet class of service (CoS) value. For an untagged packet, the port default CoS value is used.

dscp

(Optional) Classifies an ingress packet by using the packet Differentiated Services Code Point (DSCP) values (most significant 6 bits of 8-bit service-type field). For a non-IP packet, the packet CoS value is used if the packet is tagged. If the packet is untagged, the default port CoS value is used to map CoS to DSCP.

Defaults

The action is not trusted.

Command Modes

Policy-map class configuration

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

This command is not supported on the Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M Catalyst 4948E, and Catalyst 4948E-F.

Use this command to distinguish the quality of service (QoS) trust behavior for certain traffic from other traffic. For example, inbound traffic with certain DSCP values can be trusted. You can configure a class map to match and trust the DSCP values in the inbound traffic.

Trust values set with this command supersede trust values set with the qos trust interface configuration command.

If you specify trust cos , QoS uses the received or default port CoS value and the CoS-to-DSCP map to generate a DSCP value for the packet.

If you specify trust dscp , QoS uses the DSCP value from the ingress packet. For non-IP packets that are tagged, QoS uses the received CoS value; for non-IP packets that are untagged, QoS uses the default port CoS value. In either case, the DSCP value for the packet is derived from the CoS-to-DSCP map.

To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.

Examples

This example shows how to define a port trust state to trust inbound DSCP values for traffic classified with “class1 ” :

Related Commands

udld (global configuration mode)

To enable aggressive or normal mode in the UDLD protocol and to set the configurable message timer time, use the udld global configuration command. You can also use this command to set the error reporting mode for Fast UDLD.

Use the no form of this command to do the following:

Disable normal mode UDLD on all the fiber ports by default

Disable aggressive mode UDLD on all the fiber ports by default

Disable the message timer

Disable Fast UDLD error reporting mode

udld enable | aggressive

no udld enable | aggressive

udld message time message-timer-time

no udld message time

udld fast-hello error-reporting

no udld fast-hello error-reporting

Syntax Description

enable

Enables UDLD in normal mode by default on all the fiber-optic interfaces.

aggressive

Enables UDLD in aggressive mode by default on all the fiber-optic interfaces.

message time message-timer-time

fast-hello error-reporting

Sets the period of time between the UDLD probe messages on the ports that are in advertisement mode and are currently determined to be bidirectional; valid values are from 1 to 90 seconds.

If Fast UDLD is enabled and a link failure is detected, reports the link failure through a log message instead of errdisabling the port.

Defaults

All fiber-optic interfaces are disabled and the message timer for UDLD is set to 15 seconds.

Fast UDLD is disabled on all interfaces.

Command Modes

Global configuration

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(54)SG

Support for Fast UDLD was added.

Usage Guidelines

If you enable aggressive mode, once all the switch port’s neighbors have aged out either in the advertisement or in the detection phase, UDLD and Fast UDLD restart the linkup sequence. They can resynchronize with any potentially out-of-sync neighbor and shut down the port if the UDLD messages from the neighbor indicate that the link state is still undetermined.

udld (interface configuration mode)

To enable UDLD and Fast UDLD on an individual interface or to prevent a fiber-optic interface from being enabled by the udld (global configuration mode) command, use the udld interface level command. Use the no form of this command to disable UDLD, or to return a nonfiber port to the setting specified with the udld (global configuration mode) command.

udld port { aggressive | disable }

no udld port { aggressive | disable }

udld fast-hello interval

no udld fast-hello

Syntax Description

aggressive

Enables UDLD in aggressive mode.

disable

Disables UDLD.

fast-hello

Enables Fast UDLD with the configured timer.

interval

Sets the timer interval.

Defaults

The fiber-optic interfaces are enabled with the state of the global udld (enable or aggressive) command. The nonfiber interfaces are enabled with UDLD disabled.

Fast UDLD is disabled.

Command Modes

Interface configuration

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

12.2(54)SG

Support was added for Fast UDLD.

Usage Guidelines

If you enable aggressive mode, once all the switch port’s neighbors have aged out either in the advertisement or in the detection phase, UDLD and Fast UDLD restart the linkup sequence. They can resynchronize with any potentially out-of-sync neighbor and shut down the port if the UDLD messages from the neighbor indicate that the link state is still undetermined

Use the udld port aggressive command on fiber-optic ports to override the setting of the global udld (enable or aggressive) command. Use the no form of the command on fiber-optic ports to restore the UDLD state as configured by the global udld command.

If udld enable is configured globally, UDLD is enabled on all fiber-optic interfaces in nonaggressive mode. You can configure udld port aggressive on a fiber-optic interface to override the udld enable command setting and to enter aggressive mode. If you enter the no udld port aggresive command, the settings of the previous global state are reestablished and the aggressive mode is removed.

The disable keyword is supported on fiber-optic ports only. Use the no form of the udld command to reset UDLD to the value specified by the udld (global configuration mode) command.

If the port changes from fiber-optic to nonfiber-optic or vice versa, all configurations are maintained.

Examples

Related Commands

unidirectional

To configure the nonblocking Gigabit Ethernet ports to unidirectionally send or receive traffic on an interface, use the unidirectional command. To disable unidirectional communication, use the no form of this command.

unidirectional { receive-only | send-only }

no unidirectional { receive-only | send-only }

Syntax Description

receive-only

Specifies the unidirectional reception.

send-only

Specifies the unidirectional transmission.

Defaults

Disabled

Command Modes

Interface configuration mode

Command History

Release

Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Enabling port unidirectional mode automatically disables port UDLD. You must manually ensure that the unidirectional link does not create a spanning-tree loop in the network.

Examples

This example shows how to set Gigabit Ethernet interface 1/1 to receive traffic unidirectionally:

Related Commands

Displays the administrative and operational status of a switching (nonrouting) port.

username

To establish a username-based authentication system, use the username command.

username name secret { 0 | 5 } password

Syntax Description

name

User ID of the user.

secret 0 | 5

Specifies the authentication system for the user; valid values are 0 (text immediately following is not encrypted) and 5 (text immediately following is encrypted using an MD5-type encryption method).

password

Password of the user.

Defaults

No username-based authentication system is established.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Use this command to enable enhanced password security for the specified username. This command enables MD5 encryption on the password. MD5 encryption is a strong encryption method that is not retrievable. You cannot use MD5 encryption with protocols that require clear-text passwords, such as CHAP.

You can use this command for defining usernames that get special treatment. For example, you can define an “info” username that does not require a password but that connects the user to a general-purpose information service.

The username command provides both username and secret authentication for login purposes only.

The name argument can be only one word. White spaces and quotation marks are not allowed.

You can use multiple username commands to specify options for a single user.

Defaults

Command Modes

Command History

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

Each software image that is distributed on the disk uses a single checksum for the entire image. This checksum is displayed only when the image is copied into the flash memory.

The Readme file, which is included with the image on the disk, lists the name, file size, and checksum of the image. Review the contents of the Readme file before loading or duplicating the new image so that you can verify the checksum when you copy it into the flash memory or on to a server.

Use the verify /md5 command to verify the MD5 signature of a file before using it. This command validates the integrity of a copied file by comparing a precomputed MD5 signature with the signature that is computed by this command. If the two MD5 signatures match, the copied file is identical to the original file.

You can find the MD5 signature posted on the Cisco.com page with the image.

To display the contents of the flash memory, enter the show flash command. The flash contents listing does not include the checksum of the individual files. To recompute and verify the image checksum after the image has been copied into the flash memory, enter the verify command.

(Optional) Specifies the ID number of the first translational VLAN for this VLAN; valid values are from 2 to 1001. Zero is assumed if no value is specified.

tb-vlan2 tb-vlan2-id

(Optional) Specifies the ID number of the second translational VLAN for this VLAN; valid values are from 2 to 1001. Zero is assumed if no value is specified.

Defaults

The defaults are as follows:

The vlan-name is “VLANxxxx” where “xxxx” represents four numeric digits (including leading zeroes) equal to the VLAN ID number.

The media type is Fast Ethernet.

The state is active.

The said-value is 100,000 plus the VLAN ID number.

The mtu-size default is dependent upon the VLAN type:

– fddi—1500

– trcrf—1500 if V2 is not enabled; 4472 if it is enabled

– fd-net—1500

– trbrf—1500 if V2 is not enabled; 4472 if it is enabled

No ring number is specified.

No bridge number is s pecified.

No parent VLAN is specified.

No STP type is specified.

No transl ational bridge VLAN is specified.

Command Modes

VLAN configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

VLAN 1 parameters are factory configured and cannot be changed.

When you define vlan-name, the name must be unique within the administrative domain.

The SAID is documented in 802.10. When the no form is used, the VLANs SAID is returned to the default.

When you define the said-value, the name must be unique within the administrative domain.

The bridge bridge-number argument is used on ly for Token Ring-net and FDDI-net VLANs and is ignored in other types of VLANs. When the no form is used, the VLANs source-route bridging number returns to the default.

The parent VLAN resets to the default if the parent VLAN is deleted or the media keyword changes the VLAN type or the VLAN type of the parent VLAN.

The tb-vlan1 and tb-vlan2 are used to configure translational bridge VLANs of a specified type of VLAN and are not allowed in other types of VLANs. The translational bridge VLANs must be a different VLAN type than the affected VLAN; if two VLANs are specified, the two must be different VLAN types.

A translational bridge VLAN will reset to the default if the translational bridge VLAN is deleted or the media keyword changes the VLAN type or the VLAN type of the corresponding translational bridge VLAN.

Examples

This example shows how to add a new VLAN with all the default parameters to the new VLAN database:

Switch(vlan)# vlan 2

NoteIf the VLAN already exists, no action occurs.

This example shows how to cause the device to add a new VLAN, specify the media type and parent VLAN ID number 3, and set all the other parameters to the defaults:

Related Commands

vlan access-map

To enter VLAN access-map command mode to create a VLAN access map, use the vlan access-map command. To remove a mapping sequence or the entire map, use the no form of this command.

vlan access-map name [ seq# ]

no vlan access-map name [ seq# ]

Syntax Description

name

VLAN access-map tag.

seq#

(Optional) Map sequence number; valid values are from 0 to 65535.

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

If you enter the sequence number of an existing map sequence, you enter VLAN access-map mode. If you do not specify a sequence number, a number is automatically assigned. You can enter one match clause and one action clause per map sequence. If you enter the no vlan access-map name [ seq# ] command without entering a sequence number, the whole map is removed. Once you enter VLAN access-map mode, the following commands are available:

Related Commands

vlan configuration

To configure a service-policy on a VLAN, use the vlan configuration command to enter the VLAN feature configuration mode.

vlan configuration { vlan }

Syntax Description

vlan

Specifies a list of VLANs. “,” “-” operators can be used; such as, 1-10,20.

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Release

Modification

12.2(40)SG

This command was introduced on Catalyst 4900M and Supervisor Engine 6E.

Usage Guidelines

Even though an SVI is not needed in all cases, such as when you use your Catalyst 4500 series switch as a pure Layer 2 switch, you are required to create an SVI.

VLAN configuration mode has been inroduced to remove the requirement of creating an SVI. With this command you can specify lists of VLANs and the input and output policies that are applied. To configure your system in this mode there is no requirement for you to create SVIs, or create VLAN or VTP mode interactions. Once the VLAN becomes active the configuration becomes active on that VLAN. You can use “-” or “,” extensions to specifying VLAN list.

Examples

This example shows how to configure a service policy while in VLAN configuration mode and display the new service policy:

Usage Guidelines

When disabled, the native VLAN packets exiting all 802.1Q trunk ports are not tagged.

You can use this command with 802.1Q tunneling. This feature operates on an edge switch of a service-provider network and expands VLAN space by using a VLAN-in-VLAN hierarchy and by tagging the tagged packets. You must use the 802.1Q trunk ports for sending out the packets to the service-provider network. However, the packets going through the core of the service-provider network might also be carried on the 802.1Q trunks. If the native VLANs of an 802.1Q trunk match the native VLAN of a tunneling port on the same switch, the traffic on the native VLAN is not tagged on the sending trunk port. This command ensures that the native VLAN packets on all 802.1Q trunk ports are tagged.

Examples

This example shows how to enable 802.1Q tagging on the native VLAN frames and verify the configuration:

vlan filter

To apply a VLAN access map, use the vlan filter command. To clear the VLAN access maps from VLANs or interfaces, use the no form of this command.

vlan filter map-name { vlan-list vlan-list }

no vlan filter map-name { vlan-list [ vlan-list ]}

Syntax Description

map-name

VLAN access-map tag.

vlan-list vlan-list

Specifies the VLAN list; see the “Usage Guidelines” section for valid values.

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(12c)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

When configuring an action clause in a VLAN access map, note the following:

You can apply the VLAN access map to one or more VLANs.

The vlan-list parameter can be a single VLAN ID, a list of VLAN IDs, or VLAN ID ranges ( vlan-id - vlan-id ). Multiple entries are separated by (-), (hyphen), or (,) (comma).

You can apply only one VLAN access map to each VLAN.

When entering the no form of this command, the vlan-list parameter is optional (but the keyword vlan-list is required). If you do not enter the vlan-list parameter, the VACL is removed from all the VLANs where the map-name is applied.

Examples

This example shows how to apply a VLAN access map on VLANs 7 through 9:

Switch(config)# vlan filter ganymede vlan-list 7-9 Switch(config)#

vlan group

To create or modify a VLAN group, use the vlan group command in global configuration mode. Use the no form of this command to remove a VLAN list from the VLAN group.

vlan group group-name vlan-list vlan-list

no vlan group group-name vlan-list vlan-list

Syntax Description

group-name

Specifies the VLAN group name.

vlan-list

Specifies a VLAN list name. See the Usage Guidelines section below for additional information about this argument.

Defaults

This command has no arguments or keywords.

Command Modes

Global configuration

Command History

Release

Modification

12.2(54)SG

This command was modified to support user distribution on the Catalyst 4500 series switch.

Usage Guidelines

The VLAN group name can contain up to 31 characters and must begin with a letter.

The vlan-list argument can be a single VLAN ID, a list of VLAN IDs, or VLAN ID ranges ( vlan-id - vlan-id ). Multiple entries are separated by a hyphen (-) or a comma (,).

If the named VLAN group does not exist, the vlan group command creates the group and maps the specified VLAN list to the group. If the named VLAN group exists, the specified VLAN list is mapped to the group.

The no form of the vlan group command removes the specified VLAN list from the VLAN group. When you remove the last VLAN from the VLAN group, you delete the VLAN group.

You can configure a maximum of 100 VLAN groups, and map a maximum of 4094 VLANs to a VLAN group.

Examples

This example shows how to map VLANs 7 through 9 and 11 to a VLAN group:

Related Commands

vlan internal allocation policy

To configure the internal VLAN allocation scheme, use the vlan internal allocation policy command. To return to the default setting, use the no form of this command.

vlan internal allocation policy { ascending | descending }

no vlan internal allocation policy

Syntax Description

ascending

Specifies to allocate internal VLANs from 1006 to 4094.

descending

Specifies to allocate internal VLANs from 4094 to 1006.

Defaults

The default is the ascending allocation scheme.

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(19)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

You can configure internal VLAN allocation to be from 1006 and up or from 4094 and down.

The internal VLANs and user-configured VLANs share the 1006 to 4094 VLAN spaces. A “first come, first served” policy is used in allocating these spaces.

The vlan internal allocation policy command allows you to configure the allocation direction of the internal VLAN.

During system bootup, the internal VLANs that are required for features in the startup-config file are allocated first. The user-configured VLANs in the startup-config file are configured next. If you configure a VLAN that conflicts with an existing internal VLAN, the VLAN that you configured is put into a nonoperational status until the internal VLAN is freed and becomes available.

After you enter the write mem command and the system reloads, the reconfigured allocation scheme is used by the port manager.

Examples

This example shows how to configure the VLANs in a descending order as the internal VLAN allocation policy:

Syntax Description

Defaults

Command Modes

Privileged EXEC mode

Command History

Release

Modification

12.1(13)EW

Support for this command was introduced on the Catalyst 4500 series switch..

Usage Guidelines

You can verify your setting by entering the show vmps command and examining the VMPS Action row of the Reconfirmation Status section. The show vmps command shows the result of the last time that the assignments were reconfirmed either because the reconfirmation timer expired or because the vmps reconfirm command was entered.

Defaults

Command Modes

Command History

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

The first server that you entered is automatically selected as the primary server whether or not primary is entered. You can override the first server address by using primary in a subsequent command.

If a member switch in a cluster configuration does not have an IP address, the cluster does not use the VMPS server that is configured for that member switch. Instead, the cluster uses the VMPS server on the command switch, and the command switch proxies the VMPS requests. The VMPS server treats the cluster as a single switch and uses the IP address of the command switch to respond to requests.

When using the no form without specifying the ipaddress , all configured servers are deleted. If you delete all servers when dynamic-access ports are present, the switch cannot forward the packets from the new sources on these ports because it cannot query the VMPS.

You can verify your setting by entering the show vmps command and examining information in the VMPS Domain Server row.

Examples

This example shows how to configure the server with IP address 191.10.49.20 as the primary VMPS server. The servers with IP addresses 191.10.49.21 and 191.10.49.22 are configured as secondary servers:

vrf (netflow-lite exporter submode)

NoteNetFlow-lite is only supported on the Catalyst 4948E and Catalyst 4948E-F Ethernet switches.

To specify a VRF label for the NetFlow-lite collector, use the vrf command. To delete a VRF label, use the no form of this command.

vrf source-address

no vrf source-address

Syntax Description

vrf-label

Specifies a VRF label for the NetFlow-lite collector.

Defaults

global vrf

Command Modes

netflow-lite exporter submode

Command History

Release

Modification

15.0(2)SG

Support for this command was introduced on the Catalyst 4948E and Catalyst 4948E-F Ethernet switches.

Usage Guidelines

By default when no vrf label is specified the global vrf is used for routing. The vrf label is ignored if the collector's address is IPv6. Default global routing table is used to route the IPv6 export packets to the collector.

NoteSupport for VRF with IPv6 will be provided in a later release.

Examples

This example shows how to specify a VRF label for the NetFlow-lite collector:

vslp interval (virtual switch)

To configure the virtual switch link protocol (VSLP) hello packet interval, use the vslp interval command in interface configuration mode. To return to the default settings, use the no form of this command.

vslp interval interval min_rx min-interval multiplier factor

no vslp interval

Syntax Description

interval

Specifies the hello packet interval in milliseconds between the transmission of hello packets. Range: 300 to 5000.

min_rx min-interval

Specifies the minimum interval in milliseconds for received hello packets. Range: 300 to 10000.

multiplier factor

Specifies a factor in which, if no hello packets are received, the link is flagged as non operational. Range: 3 to 50.

Defaults

The interfaces are not associated.

Command Modes

Interface configuration (config-if)

Command History

Release

Modification

Cisco IOS XE 3.4.0SG and 15.1(2)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

When you specify a factor, the formula is if no hello packets are received in (min_rx * multiplier) milliseconds, the link is flagged as non-operational.

Examples

The following example shows how to configure the virtual switch link protocol (VSLP) hello packet interval:

Router-2(config-if)# vslp interval 400 min_rx 500Router-2(config-if)#

vtp (global configuration mode)

To modify the name of a VTP configuration storage file, use the vtp command. To clear a filename, use the no form of this command.

vtp {{ file filename } | { if-id name }}

no vtp {{ file filename } | { if-id name }}

Syntax Description

file filename

Specifies the IFS file where VTP configuration will be stored.

if-id name

Specifies the name of the interface providing the VTP updater ID for this device, where the if-id name is an ASCII string limited to 255 characters.

Defaults

Disabled

Command Modes

Global configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

You cannot use the vtp file command to load a new database. You can use it only to rename the file in which the existing database is stored.

You can use the vtp if-id command to specify the name of the interface providing the VTP updater ID for this device. The VTP updater is the device that adds, deletes, or modifies VLANs to a network, and triggers a VTP updater to inform the rest of the system of the changes.

Examples

This example shows how to specify the IFS file system file where VTP configuration is stored:

Related Commands

vtp client

To place a device in VTP client mode, use the vtp client command. To return to VTP server mode, use the no form of this command.

vtp client

no vtp client

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled

Command Modes

VLAN configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

If the receiving switch is in client mode, the client switch changes its configuration to duplicate the configuration of the server. If you have switches in client mode, make sure to make all VTP or VLAN configuration changes on a switch in server mode.

The vtp server command is the functional equivalent of no vtp client except that it does not return an error if the device is not in client mode.

Related Commands

vtp domain

To configure the administrative domain name for a device, use the vtp domain command.

vtp domain domain-name

Syntax Description

domain-name

Name of the domain.

Defaults

This command has no default settings.

Command Modes

VLAN configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

When you define the domain-name , the domain name is case sensitive and can be from 1 to 32 characters.

You must set a domain name before you can transmit any VTP advertisements.

Even if you do not set a domain name, the device will leave the no-management-domain state upon receiving the first VTP summary packet on any port that is currently trunking.

If the device receives its domain from a summary packet, it resets its configuration revision number to zero. Once the device leaves the no-management-domain state, it can never be configured to reenter the number except by cleaning NVRAM and reloading.

Related Commands

vtp transparent

To place a device in VTP transparent mode, use the vtp transparent command. To return to VTP server mode, use the no form of this command.

vtp transparent

no vtp transparent

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled

Command Modes

VLAN configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

The vtp transparent command disables VTP from the domain but does not remove the domain from the switch.

If the receiving switch is in transparent mode, the configuration is not changed. The switches in transparent mode do not participate in VTP. If you make VTP or VLAN configuration changes on a switch in transparent mode, the changes are not propagated to the other switches in the network.

The vtp server command is similar to the no vtp transparent command, except that it does not return an error if the device is not in transparent mode.

Related Commands

vtp v2-mode

To enable version 2 mode, use the vtp v2-mode command. To disable version 2 mode, use the no form of this command.

vtp v2-mode

no vtp v2-mode

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled

Command Modes

VLAN configuration mode

Command History

Release

Modification

12.1(8a)EW

Support for this command was introduced on the Catalyst 4500 series switch.

Usage Guidelines

All switches in a VTP domain must run the same version of VTP. VTP version 1 and VTP version 2 do not operate on switches in the same VTP domain.

If all switches in a domain are VTP version 2-capable, you only need to enable VTP version 2 on one switch; the version number is then propagated to the other version 2-capable switches in the VTP domain.

If you toggle the version 2 mode, the parameters of certain default VLANs will be modified.

Examples

This example shows how to enable version 2 mode in the VLAN database:

Switch(vlan-config)# vtp v2-modeSwitch(vlan-config)#

This example shows how to disable version 2 mode in the VLAN database: